Install Snort 2.9.8 on Windows

[@kellynwosu5269]

This video was so helpful yet I didn't realize while working with it that it was published by the professor teaching my Intrusion Detection and Prevention class. I just realized it while trying to watch the video again. Thank you so much Professor Gantz!!

[@balamodi]

You are a great teacher Steve. I had a little hitch identifying the sf_engine.so in the \lib\snor_dynamicengine folder.However, after a careful observation, I just replaced that with the sf_engine.dll file and it worked. Also, couple of changes more from the name white.list to whitelist.rules finally got my test up and running. Thanks a lot Steve, the video was brilliant and quite explanatory.

[@airblainer]

Thanks for putting this together - I really appreciate the effort!! Saved me allot of time. Great explanations!

[@babarali4313]

it is still working after 4 years. Thanks man.

[@iLikeBass23]

Watching in 2019 - thank you so, so much for this. Was incredibly helpful.

[@mikeoutdoors4729]

Thank you sir. Went from no knowledge of this program to successfully installed without too much drama. :)

[@louisbowels6858]

Thanks for the video. We're working with IDS/IPS in a class of mine and my group chose Snort so this helped a lot

[@sergeant_dornan_]

Immensely helpful video. So many half-assed guides on the web with incorrect steps to make Snort work on Windows... That 4 (!) year old video worked like a charm. Unlike official documentation (which is lacking to put it softly). I don't get it how Snort is such a widespread tool. Where do organisations that use it get all the needed info? You need to jump through hoops just to make it work, let alone configure it to your needs.

[@carlh8847]

Thanks Steve. Great, clear video at a comfortable pace. I appreciate your effort.

[@williamscott8397]

This was a great installation video. It was 30 minutes well spent.

[@rayfigueroa1315]

Great help!!!! I worked and had no luck until I viewed your video!!! Thank you!!!!

[@its_dfg]

I've done the same thing using snapshot rules and once i get to 28:00 and do "snort -i 4 -c c:\snort\etc\snort.conf -A console" it keeps telling me "ERROR: c:\snort\etc\snort.conf(0) falied to parse IP address: 32.0.0.0/35.0.0.0. Fatal error, Quitting.." How do i fix this?

[@ashb76]

Awesome! Works great! Gives a nice concept of how snort runs.

[@frankmclean3383]

Thank you very much for this, Steve. Incredibly clear, concise and helpful!

[@marcofotso3151]

Merci beaucoup pour ces instructions détaillées et l'ajout des règles.

[@RJCO_]

Excellent! Time well spent - up and running with your great instructions.

[@julay1988]

This tutorial was perfect, followed as shown and it worked, thanks!

[@phantomtq]

where can i get that snort rules snapshot?

[@umminuurnajla8552]

@@phantomtq same can't found it

[@chrisprattmt]

Sheesh. you are such a lifesaver. thank you soooo much for making this and adding all your knowledge!

[@chadwhite3754]

Great video Mr. Gantz! Hoping to see further videos.

[@marshall50fifty]

Thanks Steve your directions are very easy to follow.

[@adeelabbas7844]

such an awesome explanation you have don in this short time video, m gonna fan of you.

[@aalvarez711]

Thank you so much for this video, everything worked the first time running.

[@HudsonRicardoPereira]

Your video saved me. Thank you. It worked perfectly.

[@GiovanniSerratoSG]

Thank you so much for this video was super helpful in getting snort up and running quickly and correctly!

[@Edwin-zt7je]

This session is very helpful, thank you.

[@Неагентш00988]

Thank you very much! All works!

[@mamdouhmahfouz08]

Thanks so much for this great demo , it's really helped a lot.

[@Brezio]

Thank you Steve! Finally got it to work.

[@shriyaprasad9318]

Excellent explanation. Thank you Steve!

[@talktomooney]

Great video! This was extremely helpful.

[@lueallan4800]

I am getting the error c:\snort\etc\snort.conf(512) Unknown rule type; blacklist. Great video this has helped me move along this project much quicker than anticipated.

[@SteveGantz]

Based on the line number, I'm guessing you have not fully commented out (that is, disabled) the reputation preprocessor. You need to put a # character in the first position of every line in the preprocessor configuration in snort.conf. You should also verify that there is a \ character at the end of each of the first 5 lines in the reputation preprocessor configuration (not after the last line).

[@lueallan4800]

@@SteveGantz I made that changes and it seems to be working. Thanks for your help.

[@MsHihi123456]

I have solved it!! Big thanks to you

[@youtubeforfun75]

Great tutorial video. thank you so much!!!!

[@theironarab8993]

on Windows10 , you need the line 325 hashed out otherwise it will output an error: # decompress_swf { deflate lzma } \

[@kimkakuru1]

Great this was helpful ..made me understand ..IDS in snort ..Thanks

[@Gu215Ru]

Hello. I'm at 22:17 but when I change the directory to C: \Snort\bin and try to run bin>snort -W, I'm told the system cannot find the path specified. Any help would be greatly appreciated!! -Z

[@SteveGantz]

Once you are in c:\Snort\bin, the command is just "snort -W"

[@Fco_Iturralde]

Amazing tutorial, really helpful, Thanks!

[@briilynchh]

When I type snort -W no interfaces are listed, why might that be?

[@jonathangarciacastro1638]

chek your home net variable

[@TekNexSolutions]

Great video, thanks for your time.

[@VasquezXD]

Every interface I use, even the correct one, doesn't show alerts while running or traffic when terminated(ctrl + c). I'm using "-A console" and I even put the alert rules in local.rules... Could this be a firewall issue? @Steve Gantz

[@jonathangarciacastro1638]

i have the same error, i think is the firewall bc i try everything(rules, interfaces etc. and nothing)

[@VasquezXD]

@@jonathangarciacastro1638 Please let me know if you find the steps to fix this problem. Haven't found solution yet and I have no clue which firewall settings or rules I have to set.

[@jonathangarciacastro1638]

@@VasquezXD sure bro, do you speak spanish? English is not my first language, that's why i can't explain me better

[@VasquezXD]

@@jonathangarciacastro1638 I do not, but you can explain in Spanish and I can use google translate or get someone to help me translate it.

[@jonathangarciacastro1638]

@@VasquezXD hey, i didnt find the problem with the alerts, so i tried another way.Install snort in the firewall Pfsense and now it works perfectly for me

[@GraceToCreate]

hey. i have tried it but mine is coming up with error message saying "active response: cant open ip"

[@КонстантинГиль-р9я]

Hello Steve, I very appreciate your video. Please, make a new video about detailed configuring and testing Snort. For example - writting rules more detailed (parts of rules - what it is means), complex configurig , for testing is penetration tests, what kind exists tests and etc. Now, i am making diplom about Snort for "Smart home" - how we can protect your home network with it. There is many text, but i like more video format and exist very little good video about this, even on english language. P.S. Sorry for breaking english.

[@Russsog]

In the last step the consoe is getting stuck, how i confirm that rules are activated??

[@davidpeers706]

What would really help is the command line you type into the dos box. It's too small to see and we're not all that sharp at dos commands!

[@SteveGantz]

The first startup command I use in the video is: snort -i 4 -c c:\Snort\etc\snort.conf -T The -T at the end tells Snort to just test the configuration defined in snort.conf and then exit. As I note in the video, while interface #4 is correct for my system (the computer I was using to record the video) it is entirely likely that the right interface number for you may be different, so you may need to substitute the "4" in my startup with whatever interface number is accurate for your computer. After the test configuration succeeds, the second startup command I use is: snort -i 4 -c c:\Snort\etc\snort.conf -A console The "-A console" part directs any alert output to the screen so we can see the test rules generating alert as they happen.

[@hwanhoyoo6363]

i don't konw my interface number so i wrighten C:\Snort\bin>snort c:\Snort\etc\snort.conf -T in the cmd so i can see [312 out of 1024 flowbits in use.] and after 30 second i can see [ Number of patterns truncated to 20 bytes: 498 ] ERROR: Active response: can't open ip! Fatal Error, Quitting.. how can i resolve in this situation

[@byebyedislikecount939]

Thank you sooooo much. It has really helped me.

[@ratgreen]

For anyone reading, I was having issues with the community rules file. I was getting an error when testing. To fix it I commented out or deleted all the crap in the community-rules file, apart from the actual alerts / rules.

[@ahmadasghar7193]

hi mate i am not receiving any commencing packet processing traffic that we set the rules at the last step for tcp udp and icmp what should i do??

[@tengfeihan]

Thanks for sharing! Great help for me!

[@DMahoney84]

Any ideas why my wireless adapter is not showing up in the interface list?

[@elvisbarukcic7842]

Video is great. Just what we all "newies" like myself need for a basic start. My next question is...are there some options or instructions how to get email alerts once You set up and configure SNORT analysing packages. My idea is to mirror my network ports to one specific computer/platform, where SNORT would run all the time 24/7 and in case intrusion is detected...email or some other warning would be sent... I'm sure I'm not first one to ask this..so any good reference for adding mail warnings ?

[@voluminoeseProstituierte]

ERROR: c:\Snort\etc\C:\Snort ules\local.rules(0) Unable to open rules file "c:\Snort\etc\C:\Snort ules\local.rules": Invalid argument. some1 help

[@Yelorvi18]

Did you solve it?

[@juicz17]

I followed your step but snort gives error as I try to confirm if snort is generating traffic. ERROR: Can't start DAQ

[@FastRedPonyCar]

Is Snort still relevant these days or is there a better solution that accomplishes the same thing?

[@handhikayp]

still confusing about how to choose the right interface, because i have 9 output with 3 microsoft, and every one of them, doesn't call the output from local

[@Life-in-South-LA504]

How do i enter my IP if it's 172.18.1.x/? I get error: C:\Snort\bin>snort -i 4 -c c:\Snort\etc\snort.conf -T ERROR: Invalid device number: 4. Fatal Error, Quitting.. please help.

[@SteveGantz]

For your IP address range, go to the ipvar statement for HOME_NET in Step #1 of snort.conf and use the value 172.18.1.0/24. For your startup command, the number after the -i has to be the number of the network interface active on YOUR computer. In the video I'm using interface #4 but on your computer it is likely to be 1, 2, or 3. You can check the available interfaces by running "snort -W" from c:\Snort\bin and Snort will return an ordered list of the interfaces it can "see". Use the number of the interface you want from that list and try the startup command again.

[@omaridenver]

Snort -W does not show any interfaces on my computer!!! have any idea why?

[@vengeace2012]

I follow the instructions but when I use C:\Snort\bin>snort -i 4 -c c:\Snort\etc\snort.conf -T it give me this error: ERROR: c:\snort\etc\snort.conf(507) Unknown rule type: cancel. Fatal Error, Quitting.. And I don't undestand where is the problem... And if I comment all the lines about reputation processor, then occure this error: ERROR: c:\snort\etc\snort.conf(529) Unknown rule type: cancel. Fatal Error, Quitting.. And also in this case I don't understand where and what's the problem...Also because I don't modify line 529... Can you help me?

[@SteveGantz]

+Giorgio Mariotti Despite the line numbers in the errors it can be hard to pinpoint problems in snort.conf without knowing more about how you modified that file. The only place in the entire config file where the word "cancel" appears is in the Session Initiation Protocol preprocessor (on or near line 453). If by chance you disabled that preprocessor, can you check to make sure you commented out all the lines in the preprocessor configuration?

[@vengeace2012]

+Steve Gantz Can I send you my snort.conf file by e-mail?

[@hoanguyen-ph4qq]

ERROR: c:\Snort\etc\snort.conf(326) => Invalid keyword '}' for server configuration. Fatal Error, Quitting.. Help me!

[@SteveGantz]

In recent versions of snort.conf, line 326 is at the end of the http_inspect preprocessor or at the beginning of the ONC-RPC preprocessor declaration. Look at your snort.conf file and see if there are any lines commented out that may have a left brace character "{" in it without a corresponding right brace "}"

[@hoanguyen-ph4qq]

I find and count verry low, have 61 "{" and 61 "}", you can help me check my file snort.conf. www.mediafire.com/file/wamu32v76hbt27z/my+file+snort.rar

[@gagand33p]

Hi Hoa, I have seen this when trying to use Snort-2983 rule-source (latest) with Snort-2982 engine. If you want to get it working, please try the below: - remove "lzma" from the "preprocessor http_inspect_server .." line. - try using the Snort-2983 engine as well. Hope this helps. Gagan

[@hoanguyen-ph4qq]

Thanks Gagandeep, i delete line 326,325 and character "/" of line 324. It work!

[@kiraclone82]

work here, thanks!!!

[@MsHihi123456]

Hello sir. Thank you for such a useful video! When I execute the command(snort -i 4 -c c:\snort\etc\snort.conf -A console), I get a error massage such as ERROR: log_tcpdump: Failed to open log file "log/snort.log.1485555489": No such file or directory Fatal Error,Quitting... Could not create the registry key Do you have any ideas to solve this ? I successfully completed Snort validation part.

[@sabarorang]

same :(

[@anishmhrj7114]

Warning: No preprocessors configured for policy 0. this warning appears when i used in dump mode.it appears repeatedly. Is there any solution to remove that warning?? help me out sir

[@walkaway9834]

How does a VPN affect the Home_Net IP address in the CONF file? Thanks in advance Steve.

[@Somatan]

I've been at this program for about 3 days now trying to figure out why it's not generating traffic in my console when I do snort -i 1 -c d:\Snort\etc\snort.conf -A console. I'm in administrator mode but it just says "Commencing packet processing" at the bottom with the process ID. Also, I have found that my log files are filled with a single line of 2 accented characters (O and a) with null (or squares) after it. What could I be doing wrong?

[@Somatan]

Note: I am using Snort 2.9.11.1, I have all the rules from the registered user section and the current rules in local.rules that I have are alert icmp any any -> any any (msg:"Test test HelloWorld"; sid:1000001;) alert tcp any any -> any any (msg:"test test see me"; sid:1000002;)

[@SteveGantz]

If Snort starts up correctly but you see no output on screen then you either don't have any alert rules enabled or (assuming you do have the rules loaded as specified in snort.conf) you may have Snort listening on the wrong interface. Try running Snort with -i 2 or other alternative interface numbers.

[@jorgemacamula7876]

PLEASE help me with this: ERROR: c:\Snort\etc\snort.conf(251) Could not stat dynamic module path "c:Snort\ lib\snort_dynamicengine\sf_engine.dll": No such file or directory.

[@SteveGantz]

Jorge Macamula Check your path carefully in snort.conf. It looks like you are missing a backslash between the c: and Snort. The path should be c:\Snort\lib\snort_dynamicengine\sf_engine.dll

[@mz555]

I am also getting it in version 2.9.8.3 : Failed to find InitializePreprocessor() function in C:\Snort\lib\snort_dynamicengine\sf_engine.dll: 127

[@pedrotv1136]

My snort receive packets but dont analyze them. Can someone help me?

[@jonathangarciacastro1638]

tengo el mismo error que tu, pudiste resolverlo?

[@pedrotv1136]

@@jonathangarciacastro1638 no

[@mikecamp3935]

HELP PLEASE! Is this stating line 250 in the snort.conf is incorrect? ERROR: c:\Snort\etc\snort.conf(250) Missing/incorrect dynamic engine lib specifier.

[@SteveGantz]

MIC CAMP Many of the default settings in snort.conf are based on UNIX/Linux systems. The Snort dynamic engine setting at line 250 needs to be changed to reflect a Windows environment. Typically on Windows that line should read: dynamicengine c:\Snort\lib\snort_dynamicengine\sf_engine.dll

[@markdotimas4353]

Hi, thanks so much for this. This is a good foundation!

[@kmarshall1025]

I know this video is super old now, but hoping the OP still keeps up with it. I am running into a small issue when generating alerts. I am getting lots of alerts from UDP but even with a web browser open and trying to ping other devices on my network results in no TCP or ICMP alerts. Any suggestions on how to possibly fix this issue? Thanks for your time.

[@SteveGantz]

The first thing to check is that your TCP and ICMP testing rules have the correct syntax, particularly with respect to the msg: option so that when a TCP or ICMP rule is triggered there will be an alert message displayed. If you are seeing UDP alerts then you can be sure you are listening on an active network interface and that Snort is "seeing" sniffed traffic, so rule syntax is the next place to look. You can also try adding "-K none" to your startup command to disable checksum validation on packets, which sometimes causes issues on Windows, especially with TCP rules.

[@Skipstr78]

Got it all to run in alert mode fine. When I went to run in packet sniffer with -v, I got ERROR: Can't set DAQ BPF filter to 'console' (@CP)! Fatal Error, Quitting

[@Skipstr78]

Nevermind. Got ride of console at end and is now okay. Forgot console was just for alerts

[@chimaonyekwere8943]

Hello Steve, I received this error and I commented out on line 656 and I still got the same error- content data needs to be placed in quotation mark (")

[@emgarc1982]

Thanks - great video.

[@amanjawandha6068]

Hi i have an error in line 512 - unable to open file that is white.list Please help me to resolve this

[@jamesbond-cx2uh]

Stuck at commencing packet processing. Anyone has any idea how to solve this problem?

[@ryantahrawi]

When I try to see the version in cmd, I get an unable to open application 0xc000007b error. Also when i open the community files with 7zip, there is no rules folder. What am i doing wrong? I installed snort and the correct version of community files.

[@ayushroy2552]

For the application error, install npcap

[@halafadl-allah1408]

when i run snort -i 2 -c C:\Snort\etc\snort.conf -A console it gives me this error : Initializing rule chains... ERROR: C:\Snort ules\local.rules(21) Unmatch quote in rule option 'msg'. Fatal Error, Quitting.. and i edited local rule like u did in the video so i dunno what is the problem!?

[@SteveGantz]

Hala Fadl-allah Check the rule in line 21 of local.rules and make sure the text you put after the msg: option keyword is enclosed in quotation marks.

[@thangvu9482]

Thanks a lot ! very helpful

[@MunchyCrunchyisthegoat]

hi i m facing problem when i open comunity rules.tar file it is not showing sub folders like etc, rules means no folder is shown there kindly guide me im using windows 7 version 64 bit

[@SteveGantz]

All the rules in the Community ruleset are in a single file, called "community.rules". There is also a copy of snort.conf and sid-msg.map in the archive, but that's all. The registered and subscriber releases have more rules files, plus preprocessor rules and other files typically found in the /etc folder when you install Snort.

[@sameerchauhan1616]

Hello Steve on setting ICMP rule alert icmp any any -> any any i can see only the icmp reply and not the request in the console. How can i tweak the rule to see both echo request and echo reply traffic on console ?

[@SteveGantz]

Change the -> direction indicator in your rule to if you want to cover both directions in one rule.

[@NoBody-tz4fb]

how did you bring up the tool to replace the \\\? you just brought that up with no menu selection

[@ratgreen]

ctrl + f find and replace

[@Medumex]

Very good video thanks

[@llfrater19]

How do you install it as a service on windows ?

[@badddcompany]

I've carefully followed all your steps and I'm getting the following error message. I've tried this on two different Windows 10 machines: Initializing rule chains... ERROR: c:\Snort ules\app-detect.rules(33) Unknown ClassType: web-application-attack Fatal Error, Quitting.. Any idea what's going on?

[@SteveGantz]

The rule you are referencing (at line 33 of app-detect.rules) is enabled by default so the error is a bit strange. Have you confirmed that the ruleset you are running matches the version of Snort you have installed? There are a few different rulesets available from snort.org but if you are running the latest 2.9.9.0 version of Snort you need to have the ruleset that has the same version number.

[@CLEMENT158]

After doing c:\Snort\bin>snort -i 2 -c c:\Snort\etc\snort.conf -T I have an error c:\Snort ules\community-rules(1) Invalid configuration line: community-rules/ Fatal Error, Quitting... Maybe I did a mistake in step 7 or I don't have a good kind of file in rules folder. Can u help me pls ?

[@SteveGantz]

To use the community rules, you need to copy the community.rules file from the zip archive you downloaded from snort.org into c:\Snort ules. Then add a new line in step #7 of snort.conf that reads: include $RULE_PATH\community.rules The other include statements need to be commented out (like the ones in step #9).

[@CLEMENT158]

I have done all these things. I commented out in step 7 like in step 9 and the include statement ( include $RULE_PATH\community-rules In c:\Snort ules the community rules has to be a RULES file or only a file (type) ?

[@SteveGantz]

+knucker Snort rules files are just ascii text. The file name in snort.conf just has to exactly match the file name (including extension) as stored on the hard drive. The actual rules file needs to be extracted from the zip and saved in c:\Snort ules. It is names community.rules.

[@CLEMENT158]

I don't have the name you said with a point but I have a folder called community-rules when i extract with 7-zip and save in c:\Snort ules

[@SteveGantz]

The community rules package you download from Snort contains an archive (think of it as a folder) called community-rules. Inside that archive are five files, including the actual rules file names community.rules (the other files are AUTHORS, LICENSE, sid-msg.map, and VRT-License.txt). The community.rules file is what you want in your c:\Snort ules directory.

[@Oishifx]

hi Steve, im stock at the last step, and it get stock on ( Commencing packet processing (pid=5988) ) can i get help please ?

[@SteveGantz]

The "commencing packet processing" message means that Snort has started and is running. If you don't see anything after that on screen, you first need to confirm you have some rules active and loaded. Assuming that is the case, then you either need to make sure you are directing output to the screen (with "-A console" in your startup command) or, if you are already doing that, you need to verify that you have Snort listening on the correct network interface.

[@sivanava2971]

when I Run 'snort -W' ,no network interfaces are showing. what will i do? help me.

[@mipek280]

Did fix it ? I have same problem..

[@matthewvanwinkle7627]

I am running into the ERROR: C:\Snort\etc\c:\Snort ules\local.rules(0) Unable to open rules file. I have not loaded any local.rules and only have the black.list and white.list in the rules folder. I have looked and searched through the snort.conf text file to see if I wrote something down incorrectly but am drawing a blank.

[@SteveGantz]

Check your RULE_PATH declaration in Step #1 of your snort.conf file. Make sure the value is just the full path to the rules directory, that is, c:\Snort ules

[@matthewvanwinkle7627]

Yes, I checked there first. But still cant chase down the issue.

[@matthewvanwinkle7627]

var RULE_PATH c:\Snort ules# var SO_RULE_PATH ../so_rulesvar PREPROC_RULE_PATH c:\Snort\preproc_rules# If you are using reputation preprocessor set these# Currently there is a bug with relative paths, they are relative to where snort is# not relative to snort.conf like the above variables# This is completely inconsistent with how other vars work, BUG 89986# Set the absolute path appropriatelyvar WHITE_LIST_PATH c:\Snort ulesvar BLACK_LIST_PATH c:\Snort ules

[@SteveGantz]

You say you "only have the black.list and white.list in the rules folder". Have you copied in files from a Snort rules package, or not yet? If you haven't, then that's the source of your error. The snort.conf file is set up by default with the assumption that either the registered or subscriber rules are in place. If they aren't, you need to edit Step #7 in snort.conf to comment out references to any rules files include statements that don't have a corresponding file in c:\Snort ules.

[@matthewvanwinkle7627]

Yes I completed that part as well. I even tried commenting them all out just to do the test run.

[@ninis7thira13]

hi! I want to ask something.. I use the command "snort -W" to see my interface list and I have two Microsoft. The first one runs and gives me results and the second one just nothing. What is the difference between the two? Thank you

[@SteveGantz]

Anastasia That dpends on your computer and the features it has. Common interfaces include a wireless card, Ethernet card, and Bluetooth.

[@WycliffeMunene-z3n]

how do you check the interface number since they are different like yours is 4

[@SteveGantz]

@WycliffeMunene-z3n There is a built in command you can run: "snort -W" with an uppercase W that will return active interfaces. it worked more reliably with winPcap than it does with npcap. If you have Wireshark, you can also use that - the interface list on the capture startup screen in Wireshark will show the available interfaces in the same order that Snort uses since both programs use the same packet capture utility.

[@Barroughes]

how can i set so that Snort it logs every event alert to a notepad file in simplistic form??

[@SteveGantz]

You can add "-k ascii" to your startup command and Snort will write logs in plain text so you can read them in Notepad or another text editor.

[@2Proud2Surrender]

PLEASE HELP!!! after running the command "\bin>snort -i 0 -c c:\snort\etc\snort.conf -A console" i get following response msg: "pcap DAQ configured to passive. The DAQ version does not support reload. Acquiring network traffic from "0". ERROR: Can't start DAQ (-1) - `U╬! Fatal Error, Quitting.."

[@SteveGantz]

Sinbad the Prince You are telling Snort to run on interface zero, which doesn't exist on Windows. Try -i 1 or -i 2 instead.

[@2Proud2Surrender]

then it tells me "Invalid device number:" When i put "-W" command, result was nothing. Just dashes.

[@SteveGantz]

Sinbad the Prince Did you restart your machine after installing WinPcap? If the NPF driver isn't running then Snort can't "see" any interfaces.

[@2Proud2Surrender]

So I removed win10pcap(I'm using win 10), instaled winpcap and now I have intefaces listed but now I have next message: \Snort\etc\snort.conf(0) Failed to parse the IP address: 32.0.0.0/35.0.0.0. Fatal Error, Quitting.. Msg is the same for all interfaces

[@2Proud2Surrender]

I may have not started CMD as Admin. Before I wrote the last comment that is.

[@carlosastorgaful]

i have this problem, can you help me? this mesage : Consecutive TCP small segments exceeding threshold snort

[@SteveGantz]

That message is typically associated with an alert rule from the stream preprocessor in Snort. Many preprocessor rules for Snort look for strict adherence to protocol standards like TCP, so you'll see a lot of these kinds of alerts when you use Snort.

[@eurhiafe]

Hi. Your video has been very helpful so far. However, I ran into an issue. I'm trying to install snort on Windows 10 x64. I've followed all your steps so far, but when I try to view the interfaces with 'snort -W', nothing shows. I tried to install WinPcap and it told me that I already have it installed (probably installed it when I installed wireshark). I then looked it up and found places where it said that the -W option is only for Win32 machines. Does this mean I am unable to view my interfaces? If so, how can I test snort? Thanks.

[@SteveGantz]

eurhiafe The snort -W command does work on 64-bit Windows; the video was recorded on a 64-bit computer running Windows 10. I can't be sure why you aren't seeing results, especially if you have the NPF driver running. You mention you have Wireshark, so as an alternative you can open Wireshark and look at the interface list there - the order the interfaces are shown in Wireshark is the same as what should show up with snort -W so you can pick the right number to use from the list in Wireshark.

[@Mattador666]

So I think I have everything set up correctly but when I attempt to run Snort it will commence with the packet processing but it will not generate any results. I have wireless internet access available and am able to browse any website I want. So I am not really sure what the problem is. Any suggestions?

[@MACThinkPad]

Hi Matt, I ran into a few issues myself. But once I figured out my "-i" connection which was 3; then made sure the protocols to test were recognized so as to NOT get that "bad protocol http" msg or other wise in the 'local.rules' files ; then I was good to go!

[@Mattador666]

Coffee Break Yeah that was my issue as well. I had the wrong interface is all. Lol

[@pruthvipatel2961]

Please provide the video of how to install IDMEF Output Plugin in snort in windows.

[@SteveGantz]

As far as I know, there hasn't been an update to the IDMEF output plugin in several years, since version 2.8.x of Snort.

[@pruthvipatel2961]

Steve Gantz so can't we get snort output in IDMEF format?

[@DuongNguyen-jl4lr]

C:\Snort\bin>Snort /SERVICE /INSTALL -c c:\snort\etc\snort.conf -l c:\snort\log -K ascii -i1 [SNORT_SERVICE] Attempting to install the Snort service. [SNORT_SERVICE] The full path to the Snort binary appears to be: C:\Snort\bin\Snort /SERVICE ERROR: [SNORT_SERVICE] Unable to create Snort registry entry. The operation completed successfully. Fatal Error, Quitting.

[@nathanielg5448]

need help figure this out ERROR: c:\Snort\etc\snort.conf =>unable to open address file c:\snort ules\white.list, ERROR: No such file or directory Fetal Error, Quitting

[@SteveGantz]

Nathaniel Guerra Did you create the whitelist and blacklist files before trying to run Snort with the reputation preprocessor enabled? The files referenced in the preprocessor configuration have to exist in the referenced location; they can be empty text files, but they have to be there.

[@safasaifi3382]

Hi sir, when i do snort -w to know my interfaces i did not get a list like yours, how can i know my interface please ?

[@SteveGantz]

First of all, the command is snort -W, with an uppercase W. If you run snort -W and don't get any results then Snort is not "seeing" any available interfaces on your computer. Did you install WinPcap on your computer? Snort depends on WinPcap (and the NPF driver) to be able to sniff traffic from network interfaces. Snort prompts you during installation to install WinPcap (current version is 4.1.3) but you need to complete that action yourself.

[@safasaifi3382]

I fixed the problem , thank you so much for your help sir

[@tahirgookiny625]

Two issues I'm having here. First, it appears that snort no longer carries snapshots on their website...unless registration is required. Second, I get an error message for the community rules. What's the solution to these? Thank you.

[@SteveGantz]

The community rules are still available from the Snort.org website but the "snapshot" designation in the filename is only used for Registered and Subscriber releases. The community rules package is simply called "community-rules.tar.gz".

[@Brandon-Baker]

snort -W seems to be displaying no information. I know I have an ethernet port and a wireless adapter...trying to find a fix to this now... (windows 7 machine)

[@Brandon-Baker]

apparently if no adapters come up, then use -i 0...it will still validate the configuration in test mode.

[@Brandon-Baker]

installing winPCap fixed this issue.

[@brandong2095]

Should we now use win10pcap for Snort? I am only able to get Wireshark working with win10pcap in Windows 10 since the creators update. Thank you for this great tutorial.

[@SteveGantz]

The Snort installation routine still points Windows users to WinPcap. I haven't encountered any difficulties with Snort on Windows 10 using WinPcap 4.1.3 but there shouldn't be any downside to using win10pcap.